Re: [PATCH] spi: fix use-after-free on managed registration failure

[Andy Shevchenko]

On Wed, Mar 25, 2026 at 03:53:19PM +0100, Johan Hovold wrote:
> The SPI API is asymmetric and the controller is freed as part of
> deregistration (unless it has been allocated using
> devm_spi_alloc_host/target()).
> 
> A recent change converting the managed registration function to use
> devm_add_action_or_reset() inadvertently introduced a (mostly
> theoretical) regression where a non-devres managed controller could be
> freed as part of failed registration. This in turn would lead to
> use-after-free in controller driver error paths.
> 
> Fix this by taking another reference before calling
> devm_add_action_or_reset() and not releasing it on errors for
> non-devres allocated controllers.
> 
> An alternative would be a partial revert of the offending commit, but
> it is better to handle this explicitly until the API has been fixed
> (e.g. see 5e844cc37a5c ("spi: Introduce device-managed SPI controller
> allocation")).

Thank you!
This is good TODO list now.

Acked-by: Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>

-- 
With Best Regards,
Andy Shevchenko